Medium severity6.5NVD Advisory· Published Nov 26, 2025· Updated Jun 17, 2026
CVE-2025-12653
CVE-2025-12653
Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that under specific conditions could have allowed an unauthenticated user to join arbitrary organizations by changing headers on some requests.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
15- osv-coords8 versionspkg:apk/chainguard/gitlab-rails-ce-assets-fips-18.3pkg:bitnami/gitlabpkg:apk/chainguard/gitlab-rails-ce-18.3pkg:apk/chainguard/gitlab-rails-ce-assets-18.3pkg:apk/chainguard/gitlab-workhorse-ce-18.3pkg:apk/chainguard/gitlab-rails-ce-doc-18.3pkg:apk/chainguard/gitlab-rails-ce-doc-fips-18.3pkg:apk/chainguard/gitlab-rails-ce-fips-18.3
< 18.3.6-r2+ 7 more
- (no CPE)range: < 18.3.6-r2
- (no CPE)range: >= 18.3.0, < 18.4.5
- (no CPE)range: < 18.3.6-r2
- (no CPE)range: < 18.3.6-r2
- (no CPE)range: < 18.3.6-r2
- (no CPE)range: < 18.3.6-r2
- (no CPE)range: < 18.3.6-r2
- (no CPE)range: < 18.3.6-r2
cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*+ 5 more
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*range: 18.3
- (no CPE)range: from 18.3 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*range: >=18.3.0,<18.4.5
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*range: >=18.3.0,<18.4.5
- cpe:2.3:a:gitlab:gitlab:18.6.0:*:*:*:community:*:*:*
- cpe:2.3:a:gitlab:gitlab:18.6.0:*:*:*:enterprise:*:*:*
- Range: from 18.3 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1
Patches
Vulnerability mechanics
References
3- gitlab.com/gitlab-org/gitlab/-/issues/579372nvdBroken Link
- hackerone.com/reports/3370245nvdPermissions Required
- about.gitlab.com/releases/2025/11/26/patch-release-gitlab-18-6-1-released/nvd
News mentions
1- GitLab Patch Release: 18.6.1, 18.5.3, 18.4.5GitLab Security Releases · Nov 26, 2025